fix: preserve PyPI publisher workflow identity

[tensornull]

Summary

• run Release Please and immutable-release recovery in the single top-level publish.yml workflow
• execute pypa/gh-action-pypi-publish directly under the Trusted Publisher workflow identity while retaining attestations, protected environments, exact release verification, and first-attempt guards
• enforce the three-workflow inventory, verified selector bindings, single OIDC consumer, and reusable-publisher rejection in semantic and mutation tests
• record recovery run 30353657522 and the PyPI Build Config URI root cause in the release contract

Root cause

PyPI rejected the attested upload because the reusable caller produced release-recovery.yml@refs/heads/main as the certificate Build Config URI while the configured Trusted Publisher expected publish.yml. Reusable workflows are unsupported for this identity contract. No 0.1.0 distribution was accepted.

Verification

• uv sync --locked
• uv run ruff check src tests scripts
• uv run ruff format --check src tests scripts
• uv run pyright
• uv run pytest -m "not live" (250 passed)
• uv run python scripts/check_version.py --expected 0.1.0 --require-changelog --require-releasable-docs
• uv run python scripts/check_secrets.py
• uv run python scripts/check_workflows.py
• uv run python scripts/run_actionlint.py --offline
• uv run python scripts/check_repository_independence.py
• clean temporary artifact build, twine check, artifact inspection, and independent wheel/sdist clean-install smokes

No live request, PyPI upload, Trusted Publisher change, tag, or release mutation is part of this PR.